Six strategies for creating a secure industrial network
July 11, 2013
Security and safety are the same word in many languages. You can’t have a secure system unless you know who’s running the equipment and what they’re doing. There’s an incredible overlap between safety and security. They’re both about identifying the bad things that can happen, and finding ways to minimize the chances that they will. In the IT world, it’s about information confidentiality. On the plant floor, it’s all about the safety of people and the process. Here are some ideas for improving security in an industrial environment:
1. Pay attention to the basics. Network security can be a complex topic. Most IT security experts say the implementation of basic security features available on network devices solves over 90 percent of concerns. Basic tools such as port security, VLANs, routed interfaces and simple firewall features can stop the majority of malware and intrusions. As a simple practice, use a managed network with a good IT strategy as a starting point for network security.
2. Collaboration rules. Keep a logical separation between enterprise and control networks, including the addition of a firewall between. The policies for the enterprise network cannot be the same for control networks. The two systems have different performance requirements, reliability requirements, operating systems and applications, risk management goals, security architectures, security goals and different assumptions about security. By discussing these differences and gaining an understanding of each group's expectations and priorities, IT and control engineers within an organization can develop a solid foundation for communication and cooperation. IT and control engineers should define a role list to avoid misunderstandings. Collaboration should be the rule, not the exception. On the plant floor, use network equipment designed specifically for industrial applications.
3. Be on your guard. As with functional safety, the objects involved in security are not only devices or equipment. There are human factors as well. Security is more challenging than safety, because it's always in a state of dynamic change. New malware, viruses, worms and tools arise every day. Defenders need to be awake all the time. In an industrial environment, it's more difficult than in an office environment. The plant is not allowed to shut down its process. So policy, procedures and cooperation are very important in implementing an industrial security strategy.
4. Develop a security policy. In addition to malware issues, implementation of a security policy should also include: an authentication mechanism, data backup procedures, off-site backup of electronic media, physical protection (such as accessibility, lockable PLC panels, server rooms), hazard protection (fire, floods, EMI, etc.), a disaster recovery plan and other features as appropriate to the needs and concerns of your business.
5. Defense-in-depth. In the past, industrial network security was accomplished through air gaps. Essentially, this relied on having physically separated or isolated systems to protect plant equipment and networks from the rest of the world. This type of security resulted in industrial systems with software that wasn't kept up-to-date with the latest security patches, as well as pockets of unsecured networking equipment. Now these systems are slowly becoming connected to public networks for the purposes of remote administration, programming and monitoring, making them vulnerable to many threats. In order to protect these networks, a defense-in-depth strategy should be deployed. This type of defense protects in several places, such that bypassing a single security device does not provide unfettered access to the rest of the network. A defense-in-depth strategy should provide secure remote access through the use of VPN gateways to provide encrypted access at the external boundaries. The internal zone boundaries should employ firewall and network address translation. This can limit the scope of access by an internal action such as a phishing or a virus introduced by a trusted device inside the network, such as accessing a malicious external website. It can also provide critical device protection by isolating malfunctioning devices from broadcasting packets to the entire network and creating a denial of service. Employing an industrial VPN/NAT/firewall/router at multiple places in your network can provide an in-depth defense against many attacks aimed at industrial systems. Protect your network at the site level, internal zone and cell levels.
6. Prioritize your efforts. Every control system has one or more assets that would seriously impact production, safety or the environment if successfully attacked. These might be the SIS (safety integrated system) in a refinery, the PLC controlling chlorine levels in a water filtration plant or the RTU in an electrical substation. Plant personnel know what really matters in an operation. If these assets are aggressively protected, the chance of a truly serious cyber incident is massively reduced.
Protecting control systems
For more information about protecting industrial control and SCADA systems from security threats, download the white paper at http://awgo.to/020
Source: Tofino Security
Security threats confront every manufacturing plant
Network security is becoming a more important issue. With manufacturing facilities becoming more wired and automated, as well as accessible from outside the facility, external security is becoming an issue that in the past was typically not even a consideration.
Security, from both outside and from within the facility, must now be incorporated as part of any automation project. Consider how much cost is involved when the production facility is shut down for standard maintenance operations, which are planned and intentional. Now consider the cost impact if the facility was maliciously shut down, or if only one operation in the facility was disrupted. The cost could be devastating.
With all of the eavesdropping and international espionage in the news, it is becoming more important to secure the automated facility and product operations from outside interests (including foreign governments). Cost is becoming less an issue when compared to the potential damage that could be caused by a breakdown in security. Don't skimp by using cheap security software. A hack or virus in a system can cause the entire business to be compromised.
External access is only one security consideration. What if an outside interest gained access to your operation solely for the purpose of accessing your information without your knowledge? Gaining access to your product manufacturing process, your supply chain and other aspects of your production could provide invaluable information to an unscrupulous competitor. All of these factors and potential threats should more than justify the cost of implementing a security plan for your facility.
In addition, there are security threats from within the facility. These can be as innocent as an accidental modification to a production program or as intentional as a disgruntled employee. While many security issues can be solved by better human behavior, there's no way to guarantee that the behaviors threatening your facility will actually change.
Take all of these threats into account when developing a security plan. Considering the risks to your business, it shouldn't be difficult to justify implementing a security plan for your facility.
Traditional HMI/SCADAs are being reinvented with today's growing dependence on mobile technology. Discover how AVEVA is implementing this software into your everyday devices to...
Software-as-a-service (SaaS) gives you the technical and financial ability to respond to the changing market and provides efficient control across your entire enterprise—not just...
What happens when you adopt modern HMI solutions? Learn more about the future of operations control with these six modern HMI must-haves to help you turbocharge operator efficiency...
AVEVA System Platform (formerly Wonderware) delivers a responsive, modern operations visualization framework designed to enhance performance across all devices with context-aware...
